Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-24056: In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libpkgconf | 0:1.8.0-4.amzn2023.0.2 |
| Amazon Linux · 2023 | libpkgconf-debuginfo | 0:1.8.0-4.amzn2023.0.2 |
| Amazon Linux · 2023 | libpkgconf-devel | 0:1.8.0-4.amzn2023.0.2 |
| Amazon Linux · 2023 | pkgconf | 0:1.8.0-4.amzn2023.0.2 |
| Amazon Linux · 2023 | pkgconf-debuginfo | 0:1.8.0-4.amzn2023.0.2 |
| Amazon Linux · 2023 | pkgconf-debugsource | 0:1.8.0-4.amzn2023.0.2 |
| Amazon Linux · 2023 | pkgconf-m4 | 0:1.8.0-4.amzn2023.0.2 |
| Amazon Linux · 2023 | pkgconf-pkg-config | 0:1.8.0-4.amzn2023.0.2 |
Vulnerabilities 1
-
Medium 5.5
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgco…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-24056.html